Network Intrusion Detection System (NIDS) monitors the network
traffic in web applications. Web IDS acts as intermediate between
web application and users, as it analyzes web traffics to detect
any anomaly or malicious activity [1]}. Generally,
there are two types of detection approaches: anomaly-based
detection and signature-based detection. The signature-based IDS
system uses a signature concept, more like antivirus detects the
virus, when the antivirus database has that specific kind of virus
signature. If attackers create new virus, the antivirus is of no
use if the signature/pattern is not present. Anomaly-based
detection is based on detection unique behavior pattern
recognition or any activity that differs from previous data or
information is fed. When comparing signature-based detection
method with anomaly-based detection method, the performance of
anomaly based detection found high to detect the unknown attacks,
but it comes with a cost that it has problem with false positive
alarm rates. After detection of an anomaly it is stored in the
database it becomes a “signature”, and furthermore, there are
two detection methods which come under anomaly detection which is
adaptive detection and constant detection [2]}. An adaptive
detection algorithm analyzes the network traffic of port 80 of web
network that is HTTP traffic, which continuously gets the input of
traffic and analyzes in a timely manner, while constant based
detection method analyzes stores incoming traffic or use to
analyze the logs of collected traffic.
